configuration_policies

Creates, updates, deletes, gets or lists a configuration_policies resource.

Overview

Name	configuration_policies
Type	Resource
Id	aws.securityhub.configuration_policies

Fields

The following fields are returned by SELECT queries:

get_configuration_policy

Name	Datatype	Description
arn	string	The ARN of the configuration policy. (pattern: <code>.\S.</code>)
configuration_policy	object	An object that defines how Security Hub CSPM is configured. It includes whether Security Hub CSPM is enabled or disabled, a list of enabled security standards, a list of enabled or disabled security controls, and a list of custom parameter values for specified controls. If you provide a list of security controls that are enabled in the configuration policy, Security Hub CSPM disables all other controls (including newly released controls). If you provide a list of security controls that are disabled in the configuration policy, Security Hub CSPM enables all other controls (including newly released controls).
created_at	string (date-time)	The date and time, in UTC and ISO 8601 format, that the configuration policy was created.
description	string	The description of the configuration policy. (pattern: <code>.\S.</code>)
id	string	The UUID of the configuration policy. (pattern: <code>.\S.</code>)
name	string	The name of the configuration policy. (pattern: <code>.\S.</code>)
updated_at	string (date-time)	The date and time, in UTC and ISO 8601 format, that the configuration policy was last updated.

list_configuration_policies

Name	Datatype	Description
arn	string	The Amazon Resource Name (ARN) of the configuration policy. (pattern: <code>.\S.</code>)
description	string	The description of the configuration policy. (pattern: <code>.\S.</code>)
id	string	The universally unique identifier (UUID) of the configuration policy. (pattern: <code>.\S.</code>)
name	string	The name of the configuration policy. Alphanumeric characters and the following ASCII characters are permitted: -, ., !, , /. (pattern: <code>.\S.*</code>)
service_enabled	boolean	Indicates whether the service that the configuration policy applies to is enabled in the policy.
updated_at	string (date-time)	The date and time, in UTC and ISO 8601 format, that the configuration policy was last updated.

Methods

The following methods are available for this resource:

Name	Accessible by	Required Params	Optional Params	Description
get_configuration_policy	select	identifier, region		Provides information about a configuration policy. Only the Security Hub CSPM delegated administrator can invoke this operation from the home Region.
list_configuration_policies	select	region	NextToken, MaxResults	Lists the configuration policies that the Security Hub CSPM delegated administrator has created for your organization. Only the delegated administrator can invoke this operation from the home Region.
create_configuration_policy	insert	region, ConfigurationPolicy		Creates a configuration policy with the defined configuration. Only the Security Hub CSPM delegated administrator can invoke this operation from the home Region.
update_configuration_policy	update	identifier, region		Updates a configuration policy. Only the Security Hub CSPM delegated administrator can invoke this operation from the home Region.
delete_configuration_policy	delete	identifier, region		Deletes a configuration policy. Only the Security Hub CSPM delegated administrator can invoke this operation from the home Region. For the deletion to succeed, you must first disassociate a configuration policy from target accounts, organizational units, or the root by invoking the StartConfigurationPolicyDisassociation operation.
start_configuration_policy_association	exec	region, ConfigurationPolicyIdentifier, Target		Associates a target account, organizational unit, or the root with a specified configuration. The target can be associated with a configuration policy or self-managed behavior. Only the Security Hub CSPM delegated administrator can invoke this operation from the home Region.
start_configuration_policy_disassociation	exec	region, ConfigurationPolicyIdentifier		Disassociates a target account, organizational unit, or the root from a specified configuration. When you disassociate a configuration from its target, the target inherits the configuration of the closest parent. If there’s no configuration to inherit, the target retains its settings but becomes a self-managed account. A target can be disassociated from a configuration policy or self-managed behavior. Only the Security Hub CSPM delegated administrator can invoke this operation from the home Region.

Parameters

Parameters can be passed in the WHERE clause of a query. Check the Methods section to see which parameters are required or optional for each operation.

Name	Datatype	Description
identifier	string	The Amazon Resource Name (ARN) or universally unique identifier (UUID) of the configuration policy.
region	string	AWS region (default: us-east-1)
MaxResults	integer	The maximum number of results that's returned by ListConfigurationPolicies in each page of the response. When this parameter is used, ListConfigurationPolicies returns the specified number of results in a single page and a NextToken response element. You can see the remaining results of the initial request by sending another ListConfigurationPolicies request with the returned NextToken value. A valid range for MaxResults is between 1 and 100.
NextToken	string	The NextToken value that's returned from a previous paginated ListConfigurationPolicies request where MaxResults was used but the results exceeded the value of that parameter. Pagination continues from the MaxResults was used but the results exceeded the value of that parameter. Pagination continues from the end of the previous response that returned the NextToken value. This value is null when there are no more results to return.

SELECT examples

get_configuration_policy

Provides information about a configuration policy. Only the Security Hub CSPM delegated administrator can invoke this operation from the home Region.

SELECT
arn,
configuration_policy,
created_at,
description,
id,
name,
updated_at
FROM aws.securityhub.configuration_policies
WHERE identifier = '{{ identifier }}' -- required
AND region = '{{ region }}' -- required
;

list_configuration_policies

Lists the configuration policies that the Security Hub CSPM delegated administrator has created for your organization. Only the delegated administrator can invoke this operation from the home Region.

SELECT
arn,
description,
id,
name,
service_enabled,
updated_at
FROM aws.securityhub.configuration_policies
WHERE region = '{{ region }}' -- required
AND NextToken = '{{ NextToken }}'
AND MaxResults = '{{ MaxResults }}'
;

INSERT examples

create_configuration_policy

Creates a configuration policy with the defined configuration. Only the Security Hub CSPM delegated administrator can invoke this operation from the home Region.

INSERT INTO aws.securityhub.configuration_policies (
Name,
Description,
ConfigurationPolicy,
Tags,
region
)
SELECT 
'{{ Name }}',
'{{ Description }}',
'{{ ConfigurationPolicy }}' /* required */,
'{{ Tags }}',
'{{ region }}'
RETURNING
arn,
configuration_policy,
created_at,
description,
id,
name,
updated_at
;

Manifest

# Description fields are for documentation purposes
- name: configuration_policies
props:
  - name: region
    value: "{{ region }}"
    description: Required parameter for the configuration_policies resource.
  - name: Name
    value: "{{ Name }}"
  - name: Description
    value: "{{ Description }}"
  - name: ConfigurationPolicy
    description: |
      An object that defines how Security Hub CSPM is configured. It includes whether Security Hub CSPM is enabled or disabled, a list of enabled security standards, a list of enabled or disabled security controls, and a list of custom parameter values for specified controls. If you provide a list of security controls that are enabled in the configuration policy, Security Hub CSPM disables all other controls (including newly released controls). If you provide a list of security controls that are disabled in the configuration policy, Security Hub CSPM enables all other controls (including newly released controls).
    value:
      SecurityHub:
        ServiceEnabled: {{ ServiceEnabled }}
        EnabledStandardIdentifiers:
          - "{{ EnabledStandardIdentifiers }}"
        SecurityControlsConfiguration:
          EnabledSecurityControlIdentifiers:
            - "{{ EnabledSecurityControlIdentifiers }}"
          DisabledSecurityControlIdentifiers:
            - "{{ DisabledSecurityControlIdentifiers }}"
          SecurityControlCustomParameters:
            - SecurityControlId: "{{ SecurityControlId }}"
              Parameters: "{{ Parameters }}"
  - name: Tags
    value: "{{ Tags }}"

UPDATE examples

update_configuration_policy

Updates a configuration policy. Only the Security Hub CSPM delegated administrator can invoke this operation from the home Region.

UPDATE aws.securityhub.configuration_policies
SET 
Name = '{{ Name }}',
Description = '{{ Description }}',
UpdatedReason = '{{ UpdatedReason }}',
ConfigurationPolicy = '{{ ConfigurationPolicy }}'
WHERE 
identifier = '{{ identifier }}' --required
AND region = '{{ region }}' --required
RETURNING
arn,
configuration_policy,
created_at,
description,
id,
name,
updated_at;

DELETE examples

delete_configuration_policy

Deletes a configuration policy. Only the Security Hub CSPM delegated administrator can invoke this operation from the home Region. For the deletion to succeed, you must first disassociate a configuration policy from target accounts, organizational units, or the root by invoking the StartConfigurationPolicyDisassociation operation.

DELETE FROM aws.securityhub.configuration_policies
WHERE identifier = '{{ identifier }}' --required
AND region = '{{ region }}' --required
;

Lifecycle Methods

start_configuration_policy_association

Associates a target account, organizational unit, or the root with a specified configuration. The target can be associated with a configuration policy or self-managed behavior. Only the Security Hub CSPM delegated administrator can invoke this operation from the home Region.

EXEC aws.securityhub.configuration_policies.start_configuration_policy_association 
@region='{{ region }}' --required 
@@json=
'{
"ConfigurationPolicyIdentifier": "{{ ConfigurationPolicyIdentifier }}", 
"Target": "{{ Target }}"
}'
;

start_configuration_policy_disassociation

Disassociates a target account, organizational unit, or the root from a specified configuration. When you disassociate a configuration from its target, the target inherits the configuration of the closest parent. If there’s no configuration to inherit, the target retains its settings but becomes a self-managed account. A target can be disassociated from a configuration policy or self-managed behavior. Only the Security Hub CSPM delegated administrator can invoke this operation from the home Region.

EXEC aws.securityhub.configuration_policies.start_configuration_policy_disassociation 
@region='{{ region }}' --required 
@@json=
'{
"Target": "{{ Target }}", 
"ConfigurationPolicyIdentifier": "{{ ConfigurationPolicyIdentifier }}"
}'
;